Pierluigi Paganini
April 02, 2022
The Mirai-based distributed denial-of-service (DDoS) botnet Beastmode (aka B3astmode) now includes exploits for Totolink routers. Like most DDOS botnets, Beastmode attempt to infect other devices by launching brute-forcing attacks or exploiting multiple vulnerabilities.
Between February and March 2022, researchers from the FortiGuard Labs team observed Beastmode operators adding five new exploits in a few weeks, with three targeting some TOTOLINK routers.
The threat actors added TOTOLINK exploits just a week after the exploit codes were publicly released on GitHub in the attempt to compromise the largest number of devices as possible before the owners upgrade to the latest firmware releases.
TOTOLINK has already addressed these flaws with the release of new firmware for vulnerable devices.
Below is the list of the vulnerabilities in Totolink devices exploited by the Beastmode botnet analyzed by Fortinet:
The Beastmode botnet also includes exploits for the following issues:
Once devices are infected by the Beastmode bot, the botnet can perform a variety of DDoS attacks, including:
“Even though the original Mirai author was arrested in fall 2018, this article highlights how threat actors, such as those behind the Beastmode campaign, continue to rapidly incorporate newly published exploit code to infect unpatched devices using the Mirai malware.” concludes the report. “By continuously monitoring the evolving threat landscape, FortiGuard Labs researchers identify new vulnerabilities exploited by Mirai variants and malware targeting IoT devices to bring greater awareness to such threats and better secure our customers’ networks.”
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Beastmode botnet)
[adrotate banner=”5″]
[adrotate banner=”13″]
